Windows CLFS Driver CVE-2026-85870

Exploitation requires the attacker to already have local, authenticated access to the Windows host (PR:L) and the ability to execute code that interacts with the CLFS driver - there is no remote or network path and no victim user interaction is needed. The primary limiting factor is the High attack complexity (AC:H): the heap overflow is not deterministic and requires reliable kernel pool grooming or winning a timing/race window to convert memory corruption into SYSTEM execution, which reduces reliability on hardened or busy systems. Affected builds span essentially all supported Windows versions (Windows 10 1607 through Windows 11 26H2, and Windows Server 2012 through Server 2025) below the fixed build numbers listed in EUVD-2026-99570; patched builds are not exploitable.

This is a local privilege-escalation flaw in the Windows Common Log File System (CLFS) driver, a kernel component present in every supported Windows client and server build. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) tells a consistent story: exploitation is local, already-authenticated (PR:L), needs no user interaction, but carries High attack complexity (AC:H) - typical of heap-overflow bugs that require precise pool grooming or winning a timing/race condition before the corruption yields control. All three impact metrics are High, meaning a successful exploit gains SYSTEM-level code execution. No EPSS score, KEV listing, or POC indicator is present in the input, so by the precision rules this is 'no public exploit identified at time of analysis' - it is NOT confirmed as actively exploited. That said, the honest caveat for defenders is that CLFS has historically been one of the most heavily weaponized LPE surfaces in Windows, so an unproven exploit status today should not be read as low future risk. Net: this is a credible post-compromise escalation primitive rather than an initial-access or wormable threat. It is a genuine patch-soon priority on multi-user and server hosts, but the AC:H and PR:L prerequisites and the absence of any confirmed exploitation signal place it below internet-facing unauthenticated RCEs in triage order.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing, a compromised service account, or a web-shell) runs a crafted program that interacts with the CLFS driver to trigger a heap-based buffer overflow in kernel pool memory. By grooming the pool and winning the required timing conditions (reflected in AC:H), they corrupt kernel structures to execute code as SYSTEM, escalating from a standard user to full control of the machine. No public exploit code is identified in the provided data, so this is a plausible path rather than a confirmed in-the-wild technique.